Back Linuxsecurity

Mageia 9: Thunderbird Important Race Condition Spoofing MGASA-2025

Linuxsecurity •LinuxSecurity Advisories • November 19, 2025

Description: Race condition in the Graphics component. (CVE-2025-13012) Mitigation bypass in the DOM: Core & HTML component. (CVE-2025-13013) CVE-2025-13014: Use-after-free in the Audio/Video component. (CVE-2025-13014) Spoofing issue in Firefox. (CVE-2025-13015) Incorrect boundary conditions in the JavaScript: WebAssembly component. (CVE-2025-13016) Same-origin policy bypass in the DOM: Notifications component. (CVE-2025-13017) Mitigation bypass in the DOM: Security component. (CVE-2025-13018) Same-origin policy bypass in the DOM: Workers component. (CVE-2025-13019) Use-after-free in the WebRTC: Audio/Video component. (CVE-2025-13020)

- - - - - - - - - - - -

MGASA-2025-0305 - Updated thunderbird packages fix security vulnerabilities

- 9/core/thunderbird-140.5.0-1.mga9 - 9/core/thunderbird-l10n-140.5.0-1.mga9

- 9/core/thunderbird-140.5.0-1.mga9

- 9/core/thunderbird-l10n-140.5.0-1.mga9

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mageia 9: Multiple Race Condition Vulnerabilities in Thunderbird and Firefox Mageia 9 has reported several vulnerabilities affecting the Graphics, Audio/Video, and DOM components. Key issues include race conditions and spoofing vulnerabilities in both Thunderbird and Firefox, identified by multiple CVEs including CVE-2025-13012 and CVE-2025-13015. Users of these applications are advised to apply patches to mitigate these risks. 3 sources 22

Extracted Entities

CVEs (9)

CVE-2025-13012 CVE-2025-13013 CVE-2025-13014 CVE-2025-13015 CVE-2025-13016 CVE-2025-13017 CVE-2025-13018 CVE-2025-13019 CVE-2025-13020

Platforms (4)

Firefox Thunderbird WebAssembly WebRTC